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DETAILED ACTION 

0. 1 This office action is in response to the amendment filed on 7/25/2006. Claims 1, 12 and ' 
17 are amended. Claims 1-20 are pending. 

Claim Rejections - 35 USC §103 

1. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

2. Claims 3-4, 6, 8-11, 19 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Khazan (US Pub. No. 20050108562 Al) in view of Teal (US Pub. 2003/0120935 Al). 

As to claim 3, Khazan (fig. 4A; [0040]) shows a method comprising: intercepting a 
request on a host computer system (114; [0073]); stalling the request ([0099]); and determining 
whether the request is suspicious ([0012]), wherein upon a determination that the request is 
suspicious, adding a request entry representative of the request to a request database ([0029]). 

Khazan does not explicitly disclose a nethod determining whether malicious code activity 
is detected on the host computer system based upon the request entry. 

However, in the same field of endeavor, Teal discloses a method for network security, 
wherein malicious code activity is detected on the host computer system based upon the request 
entry ([0040]). 

Therefore, it would have been obvious to a person of ordinary skill in the art, at the time 
of the invention to combine Khazan*s technique for automatic detection of malicious code with 
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the network security method, as disclosed by Teal. Doing so would provide the ability to detect 
an intrusion into a proprietary computer network at the earliest possible time. 

As to claims 4, 6 and 8, Khazan discloses a method, further releasing the request upon a 
determination that the request is not suspicious (fig. 8; [0094]). 

As to claim 9-11, Khazan discloses a method, wherein the request is an HTTP GET 
request; and, wherein the intercepting a request on a . host computer system occurs at the 
application level ([0036; 0045]). 

As to claim 19, Khazan (figs. 8-12) discloses a computer program product comprising a 
computer readable medium containing computer program code for a method [(0016)] 
comprising: intercepting a request on a host computer system (1 14; [0073]); stalling the request 
([0099]); and determining whether the request is suspicious ([0012]), wherein upon a 
determination that the request is suspicious, adding a request entry representative of the request 
to a request database ([0029]). 

Khazan does not explicitly disclose a nethod determining whether malicious code activity 
is detected on the host computer system based upon the request entry. However, the limitation is 
obvious and very well known in the art, as evidenced by Teal ([0040]). 

See the motivation for the same reason disclosed in claim 3 above. 

Allowable Subject Matter 

3. Claims 1-2, 12-18 allowed. 

4. Claims 5, 7 and 20 are objected to as being dependent upon a rejected base claim, but 
would be allowable if rewritten in independent form including all of the limitations of the base 
claim and any intervening claims. 
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Response to Arguments 

5. Applicant's arguments with respect to claims 1-20 have been considered but are moot in 
view of the new ground(s) of rejection. The prior art of Teal has been added for new ground of 
rejection. 

Conclusion 

6. Any response to this action should be mailed to: 
Commissioner of Patents and Trademarks, Washington, D.C. 20231 

or faxed to: (703) 872-9306 for all formal communications. 

Hand-delivered responses should be brought to Crystal Park H, 2121 Crystal Drive, 
Arlington, VA, Fourth Floor (Receptionist). 

7. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Fritz Alphonse, whose telephone number is (571) 272-3813. The 
examiner can normally be reached on M-F, 8:30-6:00, Alt. Mondays off 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Albert De Cady, can be reached at (571) 272-3819. 

Any inquiry of a general nature or relating to the status of this application or proceeding 
should be directed to the Group receptionist whose telephone number is (571) 272-3824. 

Information regarding the status of an application may also be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
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system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 



system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). 




